# DNS, DHCP, Switch and Router Security: Network Infrastructure Hardening **URL:** https://securesys.com.tr/en/learning/network-security/dns-dhcp-switch-and-router-security ![DNS, DHCP, Switch and Router Security: Network Infrastructure Hardening](/images/bilgi-merkezi/covers/cover-network-11.webp) An organization's firewall infrastructure may be very strong. IDS/IPS may be active. NAC may be in use. NDR may be monitoring all East-West traffic. However, if inside the same network: DNS is configured incorrectly, DHCP is uncontrolled, the switch ports are not protected, the router management interfaces are open to broad access, a default SNMP community string is in use, or there is a shared admin account on the network devices an important part of the corporate network can still be defenceless. Because network security does not begin only with the perimeter firewall. The real foundation layer is: #### Network Infrastructure Security that is, the security of the network infrastructure. DNS, DHCP, switch, router, NTP, AAA, management interfaces infrastructure components such as these form the invisible backbone of the network. One of these systems being compromised can give the attacker: traffic manipulation, name resolution hijacking, Man-in-the-Middle, network reconnaissance, credential interception, lateral movement, service disruption possibilities such as these. For this reason a strong network security architecture must adopt this principle: **Secure the Infrastructure Before You Trust the Traffic.** ### What Is Network Infrastructure Security? Network Infrastructure Security is the protection of the organization's fundamental network components with secure configuration, access control, monitoring and hardening controls. Within this scope in particular: DNS DHCP Switch Router Wireless Controller NTP AAA infrastructures such as these are evaluated. ### What Is Network Hardening? Network Hardening is network devices and services being configured securely in order to reduce the attack surface. ### What Does Network Hardening Contain? For example: Unused Service Disable Secure Management Strong Authentication Segmentation Logging Patch Management ### Why Is Infrastructure Hardening Critical? Because the attacker can target the network infrastructure directly instead of the application. ### What Is DNS? DNS: #### Domain Name System is the system that converts domain names into IP addresses. ### Why Is DNS Critical for the Network? Because the greater part of users and applications reach services through names. ### What Happens If DNS Does Not Work? Even if many applications are reachable at the IP level, service discovery and name resolution can break. ### What Is DNS Security? It is the protection of the DNS infrastructure against spoofing, poisoning, hijacking, tunneling and abuse attacks. ### What Is DNS Spoofing? It is the attacker directing the user to the wrong IP address by producing a fake DNS response. ### What Is DNS Cache Poisoning? It is a malicious or fake DNS record being added into the DNS resolver cache. ### What Is DNS Hijacking? It is the traffic being directed to a different destination through the DNS query or configuration being changed by the attacker. ### What Result Can DNS Poisoning Produce? The user can type the legitimate domain but be directed to an attacker-controlled server. ### What Is DNSSEC? DNSSEC: #### Domain Name System Security Extensions is the mechanism aimed at verifying the authenticity and integrity of DNS records with cryptographic validation. ### Does DNSSEC Encrypt DNS Traffic? No. DNSSEC primarily: Authenticity Integrity provides these. ### What Does DNSSEC Not Provide? It does not provide DNS query confidentiality. ### What Is DoH? DoH: #### DNS over HTTPS is DNS queries being carried over HTTPS. ### What Is DoT? DoT: #### DNS over TLS is DNS traffic being encrypted over TLS. ### Is DoH Always Good From a Security Point of View? No. It can bypass corporate DNS visibility. ### What Is Shadow DNS? It is the endpoint using an unauthorized DNS resolver instead of the organization's approved DNS infrastructure. ### Should the Use of External DNS Resolvers Be Controlled? Yes. ### What Is DNS Egress Filtering? It is clients being permitted to send DNS queries only to approved DNS servers. ### A Simple DNS Policy Client ↓ Approved DNS Server ↓ Internet Direct External DNS ↓ DENY ### What Is DNS Filtering? It is access to malicious or out-of-policy domains being blocked at the DNS layer. ### What Is a DNS Sinkhole? It is malicious domain queries being directed to a controlled IP address. ### What Does a DNS Sinkhole Do? It can help to detect compromised endpoints. ### What Is DNS Threat Intelligence? It is the use of known malicious domain and infrastructure information in the DNS security policy. ### What Is DNS Tunneling? It is DNS queries and responses being used for the purpose of covert communication or data transfer. ### How Can DNS Tunneling Look? Long Subdomain High Entropy High Query Volume Unusual Record Type ### Why Is DNS Logging Important? It shows which domains the endpoint is trying to communicate with. ### Should DNS Logs Be Sent to the SIEM? Yes. ### Critical DNS Use Cases Malicious Domain DGA DNS Tunneling Excessive NXDOMAIN ### What Is NXDOMAIN? It is the response that expresses that the domain could not be found as a result of a DNS query. ### What Can a High NXDOMAIN Rate Mean? A typo, a misconfiguration or DGA malware behaviour it can be any of these. ### What Is a DNS Resolver? It is the system that performs DNS resolution on behalf of the client. ### What Is Recursive DNS? It is the resolver model that finds the final response by querying different DNS servers on behalf of the client. ### What Is Authoritative DNS? It is the DNS server that provides the authoritative records for a domain. ### Should Internal DNS and External DNS Be Separated? Yes, in many enterprise architectures the separation is useful. ### What Is Split DNS? It is a different DNS response being given to internal and external clients for the same domain. ### What Is Split-Horizon DNS? It is the other name for the split DNS approach. ### Should the DNS Server Be Open to the Internet? A recursive internal DNS server should as far as possible not be open to the internet. ### What Is an Open DNS Resolver? It is a DNS server to which anyone from the internet can send a recursive query. ### Why Is an Open Resolver Risky? It can be abused for DDoS amplification. ### What Is a DNS Zone Transfer? It is DNS zone information being transferred between servers. ### What Is AXFR? It is the full DNS zone transfer mechanism. ### Should a Zone Transfer Be Open to Everyone? No. Only authorized DNS servers must be permitted. ### What Is Zone Transfer Disclosure? It is the attacker learning internal or external host information through a DNS zone transfer. ### What Is DHCP? DHCP: #### Dynamic Host Configuration Protocol is the protocol that provides automatic IP configuration to clients. ### What Does DHCP Provide? IP Address Subnet Mask Default Gateway DNS Server ### Why Is DHCP Critical for Network Security? An incorrect DHCP response can change the client's entire network traffic path. ### What Is Rogue DHCP? It is an unauthorized DHCP server distributing IP configuration to clients on the network. ### What Can Rogue DHCP Do? To the client an attacker-controlled: Gateway DNS Server it can give these. ### Can Rogue DHCP Create a Man-in-the-Middle? Yes. If an incorrect gateway or DNS is distributed the traffic can be routed through the attacker. ### What Is DHCP Starvation? It is an attempt to consume the available IP addresses in the DHCP pool. ### What Is DHCP Exhaustion? It is the DHCP lease pool becoming full. ### What Is DHCP Snooping? It is the Layer 2 security mechanism that makes it possible to control trusted and untrusted DHCP messages at switch level. ### What Does DHCP Snooping Provide? It helps to block unauthorized DHCP server responses. ### What Is a Trusted Port? It is the switch port to which the legitimate DHCP server or the uplink is connected. ### What Is an Untrusted Port? They are the ports, such as client ports, that should not send a DHCP server response. ### What Is the DHCP Snooping Binding Table? IP address, MAC address, VLAN, port it is the table in which these matchings are recorded. ### Why Is the Binding Table Important? It can be used for Dynamic ARP Inspection and IP Source Guard. ### What Is DHCP Option 82? It is the option used by the DHCP relay/edge device to add client location information. ### What Is a DHCP Snooping Rate Limit? It is the limiting of the number of DHCP messages coming from a switch port. ### Can It Reduce DHCP Starvation? Yes. ### What Is ARP? ARP: #### Address Resolution Protocol matches IP addresses with MAC addresses on an IPv4 network. ### What Is ARP Spoofing? It is the attacker changing the IP-MAC mapping by sending fake ARP messages. ### What Is ARP Poisoning? It is the ARP cache being poisoned with a malicious mapping. ### For What Purpose Is ARP Spoofing Used? Man-in-the-Middle Traffic Interception Session Hijacking ### What Is Man-in-the-Middle? It is the attacker entering the communication path between two systems and monitoring or modifying the traffic. ### What Is Dynamic ARP Inspection? DAI: #### Dynamic ARP Inspection is the Layer 2 security mechanism that validates ARP packets with trusted binding information. ### Which Data Can DAI Use? The DHCP Snooping Binding Table. ### Does DAI Block ARP Spoofing? It helps to reduce it significantly. ### How Does DAI Work on Static IP Devices? A static ARP ACL or manual binding may be needed. ### What Is IP Source Guard? It is the mechanism that checks whether the source IP of the packet coming over the switch port is consistent with the expected IP-MAC-port binding. ### What Does IP Source Guard Provide? It reduces the IP spoofing risk. ### **Why Are DHCP Snooping + DAI + IP Source Guard Used Together?** Because they are Layer 2 security controls that complement one another. ### The Layer 2 Security Chain DHCP Snooping ↓ DAI ↓ IP Source Guard ↓ Port Security ### What Is Port Security? It is the security mechanism that limits which MAC addresses can be used on a switch port. ### What Does Port Security Provide? It reduces the unauthorized device connection risk. ### What Is Maximum MAC Address? It is the maximum number of MAC addresses permitted on a switch port. ### What Is Sticky MAC? It is the switch automatically adding the learned MAC address to the port security configuration. ### What Is a Port Security Violation? It is an out-of-policy MAC address being seen on the port. ### What Can the Violation Action Be? Protect Restrict Shutdown ### What Is Shutdown Mode? It is the switch port being disabled in the case of a violation. ### What Is Err-Disable? It is the switch automatically disabling the port after a certain security or error event. ### Should Auto-Recovery Be Used? It must be evaluated on a risk basis. ### What Is MAC Flooding? It is the attack aimed at filling the switch CAM table with a large number of fake MAC addresses. ### What Is a CAM Table? It is the table in which the switch holds the MAC address to physical port mapping information. ### What Can CAM Table Overflow Cause? The switch can flood some traffic to broader ports. ### Does Port Security Reduce the MAC Flooding Risk? Yes. ### What Is VLAN Hopping? It is the attacker trying to pass to a VLAN they normally cannot reach. ### What Are the Types of VLAN Hopping? Switch Spoofing Double Tagging ### What Is Switch Spoofing? It is the attacker trying to behave like a switch using trunk negotiation. ### What Is DTP? DTP: #### Dynamic Trunking Protocol is the protocol used for trunk negotiation on Cisco switches. ### Should Dynamic Trunking Be Disabled on User Ports? Yes. ### Should the Access Port Be Defined Explicitly? Yes. ### What Is the Native VLAN? It is the VLAN to which untagged traffic on an 802.1Q trunk belongs. ### Is the Native VLAN Important From a Security Point of View? Yes. ### Is Using the Default VLAN Risky? It is preferred that it not be reserved for management and user traffic. ### Should VLAN 1 Be Used? As far as possible it must be separated from user and management traffic. ### What Should Be Done With Unused Ports? They must be shut down. ### What Is a Parking VLAN? It is the unused VLAN to which unused ports are moved. ### What Is Switch Port Hardening? It is access ports being configured with the minimum necessary network capability. ### What Is STP? STP: #### Spanning Tree Protocol is the protocol that prevents Layer 2 loops from occurring. ### What Is an STP Attack? It is the attacker trying to have an effect on the topology by sending forged STP/BPDU messages. ### What Is a BPDU? Bridge Protocol Data Unit. It is the STP communication message. ### What Is BPDU Guard? It is the security feature that reduces the rogue switch risk by disabling the port when a BPDU is seen on an access port. ### Where Is BPDU Guard Used? On edge/access ports. ### What Is BPDU Filter? It is the feature that limits BPDU transmission or processing. ### Should BPDU Filter Be Used Carefully? Yes. Incorrect use can create a Layer 2 loop. ### What Is Root Guard? By having superior BPDUs accepted from a certain port it helps to prevent a rogue root bridge from occurring. ### What Is a Root Bridge? It is the central reference switch of the STP topology. ### Why Is a Rogue Root Bridge Risky? The traffic path can change over an attacker-controlled or unauthorized switch. ### What Is Loop Guard? It helps to reduce the STP loop risk in unidirectional or BPDU loss situations. ### What Is Storm Control? It is the mechanism that limits the amount of broadcast, multicast or unknown unicast traffic. ### What Is a Broadcast Storm? It is the Layer 2 network being affected because of excessive broadcast traffic. ### Does Storm Control Reduce the DoS Risk? Yes. ### What Is Switch Hardening? It is the switch's management, access port, trunk and protocol configurations being made secure. ### The Basics of a Switch Hardening Checklist Unused Port Disable Port Security DHCP Snooping DAI BPDU Guard ### What Is a Router? A router is the device that performs Layer 3 traffic forwarding between different networks. ### Why Is Router Security Critical? Routing decisions determine the network traffic path. ### What Is Router Hardening? It is the router's management, routing protocol and traffic forwarding configuration being made secure. ### What Is the Control Plane? It is the layer on which the router carries out the routing protocol and system control operations. ### What Is the Data Plane? It is the layer on which the actual network packet forwarding operation takes place. ### What Is the Management Plane? It is the layer on which the administrator manages the network device. ### Why Is Management Plane Security Critical? A device compromise can turn directly into a network compromise. ### Should the Management Interface Be Reachable From the User Network? As far as possible, no. ### What Is a Dedicated Management Network? It is the segment reserved for network device management traffic. ### What Is Out-of-Band Management? It is the management network independent of the production data network. ### What Is In-Band Management? It is management access being provided over the production network. ### Is Out-of-Band More Secure? It provides an advantage in terms of attack surface isolation. ### Can a Jump Host Be Used for Network Administration? Yes. ### What Is a Bastion Host? It is the hardened intermediary system used for access to sensitive infrastructure. ### The Network Admin Access Model Administrator ↓ MFA ↓ VPN / ZTNA ↓ Bastion ↓ Management VLAN ↓ Network Device ### Should Telnet Be Used? No. ### Why? Credentials and traffic can be carried in clear text. ### What Is SSH? Secure Shell. It is an encrypted remote administration protocol. ### Should SSHv2 Be Used? Yes. Legacy protocols must be disabled. ### What Is HTTPS Management? It is the web management interface being reached over TLS. ### Should HTTP Management Be Disabled? If possible, yes. ### What Is a Management ACL? It limits which source IPs can reach the device management interface. ### Why Is a Management ACL Important? It reduces the admin interface attack surface. ### What Is Source-Based Management Restriction? It is access being given only from the management subnet or the bastion host. ### What Is AAA? AAA: #### Authentication, Authorization and Accounting is the identity verification, authorization and operation recording model. ### Should Central AAA Be Used Instead of Local Accounts? Yes, if possible. ### What Is TACACS+? It is the central AAA protocol widely used for network device administration. ### What Is RADIUS? It is the AAA protocol used for network access authentication and accounting. ### What Is the Difference Between TACACS+ and RADIUS? Both provide AAA but their usage model and protocol behaviours are different. ### Can TACACS+ Be Used for Network Device Admin? Yes. ### What Is Command Authorization? It is the limiting of which CLI commands the administrator can run. ### Can TACACS+ Provide Command Authorization? Yes. ### What Is a Named Admin Account? It is each administrator using their own individual account. ### Should a Shared Admin Account Be Used? No. ### What Is a Break-Glass Account? It is the local emergency account used in emergency situations such as a central AAA failure. ### How Should a Break-Glass Account Be Protected? With a strong password, restricted use, monitoring, a secure vault with these. ### Can MFA Be Used in Network Device Administration? Yes. It can be applied according to the management architecture. ### Is Privileged Access Management Used on Network Devices? Yes. ### What Can PAM Provide? Credential Vault Approval Session Recording ### What Is SNMP? SNMP: #### Simple Network Management Protocol is the network device monitoring and management protocol. ### Is SNMPv1 Secure? No. It is legacy and provides weak security. ### Is SNMPv2c Secure? Because it uses community string based authentication it is limited. ### Why Is SNMPv3 Stronger? It offers authentication and encryption capability. ### What Is a Default Community String? For example: public private they are common community strings such as these. ### Should Default Community Strings Be Used? No. ### Is SNMP Read-Write Access Risky? Yes. It can create a configuration change risk. ### Should Read-Only SNMP Be Preferred? For monitoring, as far as possible yes. ### Should SNMP Access Be Limited With an ACL? Yes. ### What Is Syslog? It is the mechanism that makes it possible for network device logs to be sent to a central logging server. ### Should Network Device Logs Be Sent to the SIEM? Yes. ### Which Network Device Events Are Important? Admin Login Configuration Change Interface State Routing Change Security Violation ### What Is a Configuration Change Alert? It is an alarm being produced when there is a change in the network device configuration. ### Why Is an Unauthorized Configuration Change Critical? The traffic path or the security policy can be changed by the attacker. ### What Is a Configuration Backup? It is the backing up of the network device configuration. ### Why Is a Configuration Backup Important? It provides a rollback after a failure or an unauthorized change. ### What Is a Versioned Configuration Backup? It is each configuration change being stored as a different version. ### What Is a Configuration Diff? It is the comparison of the differences between two configuration versions. ### What Is Config Drift? It is the device configuration deviating over time from the approved baseline. ### What Is Configuration Compliance? It is the checking of the conformity of the device configuration to the security baseline. ### What Is a Golden Configuration? It is the approved secure configuration template. ### What Is Network Configuration Management? It is switch/router config changes being managed centrally. ### Why Is Change Management Important for Network Security? An incorrect rule or routing change can create a serious outage and security gap. ### Is a Peer Review Necessary? For critical network changes it is a strong practice. ### What Is a Rollback Plan? It is the plan for returning to the previous configuration when the change fails. ### What Is NTP? NTP: #### Network Time Protocol synchronizes the clocks of network devices. ### Why Is NTP Important for Security? For log correlation and forensics the timestamps need to be consistent. ### What Happens If the Clocks Are Different? It becomes difficult to create an incident timeline. ### What Is a Trusted NTP Source? It is the time source approved by the organization. ### Should the Use of External NTP Be Controlled? Yes. ### What Is Routing Protocol Security? It is the protection of the routing information exchange between routers. ### What Is OSPF? Open Shortest Path First is one of the internal routing protocols. ### What Is BGP? Border Gateway Protocol is the protocol used for internet and large network routing. ### Why Is Routing Protocol Authentication Important? It reduces the unauthorized route advertisement risk. ### What Is Route Hijacking? It is the traffic being directed to a different path because of an incorrect or malicious route announcement. ### What Is BGP Hijacking? It is the traffic being directed to another network with an incorrect or malicious BGP prefix announcement. ### What Is Prefix Filtering? It is the limiting of which route advertisements will be accepted. ### What Is Route Filtering? It is the routes that will enter the routing table being controlled with policy. ### What Is Control Plane Policing? CoPP: #### Control Plane Policing is the mechanism that limits the traffic coming to the router/switch control plane. ### Why Is CoPP Important? It reduces the control plane DoS risk. ### Is Management Plane DoS Possible? Yes. SSH, SNMP or routing/control traffic can create an overload. ### What Is an Infrastructure ACL? It is the ACL used to limit the traffic directed at network infrastructure devices. ### Should ICMP Be Disabled Completely? No. It must be filtered according to the operational requirement and the security need. ### Why Is ICMP Necessary for the Network? It is used in functions such as troubleshooting and path MTU. ### Does a Network Device Banner Provide Security? On its own, no. However, it can be used for the purpose of legal/security notification. ### Should the Device Hostname Contain Sensitive Information? It is preferred that it not give unnecessary architecture details. ### What Is Firmware Security? It is the network device OS/firmware being kept up to date and in a supported state. ### What Is Network Device Patch Management? It is vendor security updates being applied on a risk basis. ### Do CVEs Affect Network Devices? Yes. Vulnerabilities can be found on router, switch, DNS and DHCP platforms too. ### What Is EOL? End of Life. It is a product whose vendor support has ended. ### What Is EOS? End of Support. Security updates or technical support can end. ### Is Using an EOL Network Device Risky? Yes. ### What Is Network Vulnerability Management? It is infrastructure device vulnerabilities being continuously detected and remediated. ### Can a Network Device Vulnerability Scan Be Performed? Yes. However, it must be done in a controlled way in terms of production impact. ### Is Secure Boot Used on Network Devices? According to the platform, yes. ### What Is Image Signing? It is the verification of the integrity and authenticity of the device firmware/software image. ### What Is Unauthorized Firmware? It is firmware that is not trusted by the vendor or has been modified. ### Is Supply Chain Risk Valid for Network Devices? Yes. ### What Is a Network Device Inventory? It is all router, switch and infrastructure devices being kept on record. ### What Should the Asset Inventory Contain? Device Model Serial Number IP Address Firmware Version Location ### Why Is an Unknown Network Device Risky? It can be unauthorized or unmanaged infrastructure. ### What Is a Rogue Switch? It is a switch connected to the network without approval by the organization. ### What Is a Rogue Router? It is an unauthorized routing device. ### Why Is Network Topology Documentation Important? It makes it possible to understand the security boundaries and traffic paths. ### What Is Layer 2 Topology? They are the switch, trunk and VLAN relationships. ### What Is Layer 3 Topology? They are the subnet, router and routing path relationships. ### What Is Network Segmentation Documentation? It shows which segment is separated with which firewall/routing control. ### Are DNS and DHCP High Availability Necessary? In critical environments, yes. ### What Is DHCP Redundancy? It is the other one being able to continue the lease service in the case of one DHCP server failure. ### What Is DNS Redundancy? It is the other resolver continuing to work in the case of one DNS server failure. ### What Is Infrastructure Resilience? It is connectivity being able to continue in the case of a network service failure. ### What Is a Redundant Core Switch? It is the core network being designed redundantly against a single device failure. ### What Is a Redundant Router? It is more than one router being used for gateway/routing service continuity. ### What Is FHRP? First Hop Redundancy Protocol. It is the protocol class that provides default gateway redundancy. ### What Is HSRP? Hot Standby Router Protocol. It is a gateway redundancy mechanism. ### What Is VRRP? Virtual Router Redundancy Protocol. It provides gateway high availability. ### Does Redundancy Mean Security? No. It provides availability. Security must be applied separately. ### What Is Network Infrastructure Monitoring? It is the central monitoring of DNS, DHCP, switch and router health/security events. ### What Should Infrastructure Monitoring Contain? CPU Memory Interface Routing Neighbor Admin Login Config Change ### Can a CPU Spike Be a Security Event? Yes. It can be the result of DoS or abnormal traffic. ### Is a Routing Neighbor Down Event Important? Yes. It can be an indicator of a connectivity or routing attack. ### Is MAC Address Table Change Monitoring Used? It can be evaluated in high-security environments. ### What Is an STP Topology Change Alert? It is the monitoring of a Spanning Tree topology change. ### Why Can an STP Topology Change Be Suspicious? It can be an unauthorized switch or a physical topology change. ### Should a DHCP Snooping Violation Be Logged? Yes. ### Should a DAI Violation Be Logged? Yes. ### Should a Port Security Violation Be Sent to the SIEM? Yes. ### Network Infrastructure SIEM Use Cases Rogue DHCP ARP Spoofing Attempt Unauthorized Admin Login Configuration Change ### Can Network Infrastructure Be Monitored With NDR? In terms of network behaviour, yes. ### Are Infrastructure Logs and NDR Used Together? Yes. ### What Is Network Infrastructure Threat Hunting? It is the searching for suspicious behaviour on routing, DNS, DHCP and network device logs. ### What Is a Network Infrastructure Baseline? It is the normal routing, DNS, DHCP and switch behaviour profile. ### An Example of a Normal Baseline Normal DNS Request Volume Normal DHCP Lease Count Known Routing Neighbors Known Admin Sources ### What Should Be Done If the Baseline Changes? Change management and the security event must be evaluated together. ### What Is Infrastructure Segmentation? It is DNS, DHCP and network management systems being kept in dedicated security segments. ### Should the Management VLAN and the Server VLAN Be the Same? As far as possible, no. ### In Which Zone Should Network Management Systems Be? In a protected management zone. ### Should a Jump Host Be Mandatory? In critical environments it is a strong control. ### What Is the Network Infrastructure Zero Trust Approach? It is the admin who reaches the network device not being automatically accepted as trusted. ### How Should Admin Access Be Verified? Identity MFA Authorized Device Approved Source ### What Is Network Infrastructure Least Privilege? It is the administrator being given only the necessary command and device access. ### What Is a Read-Only Network Role? It is the monitoring/admin role that cannot change the configuration. ### Should the Operator and the Administrator Be Separated? If possible, yes. ### What Is a Network Infrastructure Security Assessment? It is the evaluation of DNS, DHCP, switch and router configurations from a security point of view. ### What Does the Assessment Examine? Management Access Layer 2 Security Routing Security Logging Firmware ### What Is a Network Configuration Audit? It is the configuration files being analyzed against the hardening baseline. ### Is the CIS Benchmark Used for Network Devices? For some vendors and platforms configuration guidance can be available. ### What Is a Vendor Hardening Guide? They are the secure configuration recommendations published by the manufacturer. ### What Is a Security Baseline? It is the minimum security configuration standard the organization has determined for network devices. ### What Should a Network Device Baseline Contain? SSH only SNMPv3 AAA Management ACL Central Logging ### Secure Network Infrastructure Checklist - Are the DNS servers up to date? - Is recursive DNS closed to the internet? - Has DNSSEC been evaluated? - Do the DNS logs go to the SIEM? - Is the use of external DNS being limited? - Is DHCP Snooping active? - Is there rogue DHCP detection? - Is DAI active? - Is IP Source Guard being used? - Is Port Security active? - Are unused switch ports shut down? - Is BPDU Guard being used? - Is Root Guard active where necessary? - Is Storm Control being used? - Is trunk negotiation disabled on user ports? - Is the management VLAN separate? - Is Telnet disabled? - Is SSHv2 active? - Is HTTP management disabled? - Is a management ACL being applied? - Is central AAA active? - Is TACACS+/RADIUS being used? - Have shared admin accounts been removed? - Is SNMPv3 being used? - Are config backups being taken? - Are config changes being logged? - Has NTP been configured securely? - Is routing protocol authentication being used? - Is the firmware up to date? - Have EOL devices been identified? ### The Most Frequently Made Mistakes in Network Infrastructure Security The mistakes frequently seen in organizations: - Leaving the DNS resolver open to the internet - Not controlling the use of external DNS - Not collecting DNS logs - Not using DHCP Snooping - Not taking the rogue DHCP risk seriously - Not using DAI - Not using Port Security - Leaving unused ports open - Leaving dynamic trunk negotiation open - Not using BPDU Guard - Carrying management traffic on the user VLAN - Using Telnet - Using the SNMPv2c default community string - Using a shared admin account - Not using central AAA - Not taking configuration backups - Not performing config change monitoring - Not using routing protocol security - Continuing to run EOL network devices - Delaying firmware updates ### Network Infrastructure Maturity Model #### Level 1 - Basic Infrastructure Switches, routers, DNS and DHCP work with a default/basic configuration. #### Level 2 - Hardened Infrastructure Secure management, firmware and basic Layer 2 security are applied. #### Level 3 - Controlled Infrastructure DHCP Snooping, DAI, AAA, centralized logging and configuration management become active. #### Level 4 - Monitored Infrastructure The infrastructure is continuously monitored with the SIEM, NDR and automated configuration compliance. #### Level 5 - Zero Trust Network Infrastructure Admin identity, privileged access, device trust, continuous compliance and automation are used together. ### Frequently Asked Questions #### What is DNS Security? DNS Security is the protection of the DNS infrastructure and query processes against spoofing, poisoning, hijacking and malicious domain risks. #### What is DNSSEC? DNSSEC is the mechanism that helps to verify the authenticity and integrity of DNS records with a cryptographic signature. #### What is DHCP Snooping? DHCP Snooping is the Layer 2 security mechanism that serves to block unauthorized DHCP responses on the switch and to create IP-MAC binding information. #### What is Rogue DHCP? It is the DHCP server that distributes IP, gateway or DNS configuration in an unauthorized way on the corporate network. #### What is ARP Spoofing? It is the attacker trying to route the traffic through themselves by manipulating the IP-MAC mapping with fake ARP messages. #### What is Dynamic ARP Inspection? DAI is the switch security feature that reduces the ARP spoofing risk by validating ARP messages with trusted IP-MAC binding information. #### What is IP Source Guard? It is the Layer 2 security mechanism that checks whether the source IP is consistent with the switch port and MAC binding. #### What is Port Security? It is the security mechanism that limits the number or identity of the MAC addresses permitted on a switch port. #### What is BPDU Guard? It is the security feature that protects the port in order to reduce the rogue switch risk in the event that an STP BPDU is seen on an access port. #### What is Root Guard? It is the control mechanism that helps to prevent an unauthorized switch from becoming the STP root bridge. #### What is SNMPv3? It is the more secure SNMP version that supports authentication and encryption. #### What is TACACS+? It is the central AAA protocol that provides authentication, authorization and accounting for network device administration. #### What is the Network Management Plane? It is the layer on which routers, switches and security devices are managed by the administrator. #### What is network hardening? It is network devices and services being configured with a secure configuration that will reduce the attack surface. ### Conclusion: If the Firewall Is Strong It Does Not Mean the Network Is Secure Network security does not consist only of firewall policy. Because even before the traffic reaches the firewall: DNS resolution, DHCP configuration, ARP resolution, switch forwarding, routing decisions it passes through many critical infrastructure operations such as these. If one of these layers is manipulated the attacker can have an effect on the communication path even without directly crossing the firewall. For this reason a strong enterprise network security model: #### DNS Security ↓ #### DHCP Security ↓ #### Layer 2 Security ↓ #### Routing Security ↓ #### Management Plane Security ↓ #### Central Monitoring must be thought of in this way. At the Layer 2 level in particular: **DHCP Snooping + Dynamic ARP Inspection + IP Source Guard + Port Security** they are important controls that complement one another. At the switch level: **BPDU Guard + Root Guard + Storm Control + Secure Trunking** they help to protect the Layer 2 topology. In router and network device management, on the other hand: **SSH + AAA + TACACS+ + MFA + Management ACL + Dedicated Management Network** this approach strengthens privileged network access. On the DNS side: **DNSSEC + DNS Filtering + Controlled Resolvers + DNS Logging** they make the name resolution layer more secure. And above all of these: **Central Logging + SIEM + NDR + Configuration Monitoring** they make the changes in the network infrastructure visible. For this reason the fundamental principle of Network Infrastructure Security is this: **Before protecting the traffic the network carries, protect the infrastructure that carries the network.** Because a compromised switch, a DNS server that misdirects or an unauthorized DHCP server can leave even the network behind the strongest firewall under serious risk. The modern network hardening equation: **Secure Configuration + Least Privilege + Layer 2 Protection + Secure Management + Continuous Monitoring** is in this form.